CVE-2020-12859: Health Covidsafe

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Unnecessary fields in the OpenTrace/BlueTrace protocol in COVIDSafe through v1.0.17 allow a remote attacker to identify a device model by observing cleartext payload data. This allows re-identification of devices, especially less common phone models or those in low-density situations.

Affected products

• Health Covidsafe: up to and including 1.0.17

Published 2020-05-18. Last modified 2026-06-17.